Check Point DDoS Protector Reviews

We use this product as our DDoS mitigation solution. This is something that needs to be able to protect against DDoS attacks for Volumetric, Low, and Slow attacks across layer three to layer seven. 

The solution also needs to integrate with a scrubbing center and route traffic in the case of a volumetric attack. It must also have deep knowledge of DNS traffic behavior and must have early and accurate detection/mitigation.

A DDoS mitigation solution must be able to handle high rates of DNS packets and provide the best quality of experience, even under attack. It must also be able to allow or block traffic based on geolocation or a specific IP address.

A DNS Subdomain Whitelist is available, allowing only the good DNS queries through.

This solution is able to mitigate and protect against SSL attacks, which is important because this type of attack is becoming more popular among attackers, as it only requires a small number of packets to cause a denial of service for a fairly large service.

Attackers launch attacks that use SSL because each SSL session handshake consumes more resources from the server-side than from the client-side, meaning the attack has exponentially increased in size without requiring additional bots or bandwidth. As a result of these amplification effects, even a small attack can result in crippling damage

This solution is able to mitigate attacks and provides automated DDoS defense and protection from fast-moving, high volume, encrypted, or very short duration threats. This includes IoT-based attacks like Mirai, Pulse, Burst, DNS, TLS/SSL attacks, and those attacks associated with Permanent Denial of Service (PDoS) and Ransom Denial-of-Service (RDoS) techniques.

This product uses auto-learning and behavioral analysis to establish baselines for legitimate traffic, and automatically detects and blocks traffic behavior that does not conform. 

The SSL decryptor card comes by default with the appliance and can be enabled if needed with the purchase of a license.

This solution uses asymmetric deployment with a challenge/response mechanism that has lower latency & higher capacity to block SSL/TLS attacks.

Behavior-based protection with automatic signature creation against unknown, zero-day DDoS attacks is employed.

Support for wildcard certificates reduces operational complexity because the admin doesn't have to update it every time a certificate changes.

The Cloud Signaling capability is able to route traffic to the scrubbing center in case of a volumetric attack.

It offers effective protection against DNS attacks.

It provides layer three to layer seven protection in on-premises, cloud, and hybrid environments. It's able to detect and mitigate attacks with no performance impact or risk.

This product has a dedicated DoS mitigation engine (DME) that off-loads high-volume attacks, inspecting without impacting user experience.

It does not provide the capability to upload data for blacklisting/whitelisting in bulk. Rather, in cases where many IP addresses need to be blacklisted or whitelisted, either a single IP address has to be added or it needs to be done using a script.

It does not provide default server grouping such as default policy that can be enabled on a Web Server or Application Server IP address.

The dashboard is complicated.

It does not provide real-time traffic details; instead, it only provides logs for blocked traffic. During troubleshooting, a complete log file is required for forensics.

A PCAP file is not provided for individual IP, which is something that should be improved.

This is a stable product.

These devices are very much scalable and installed in HA. It provides an automatic passthrough option in the case of ethernet for fiber, where the OEM provides a fiber bypass switch that needs to be installed.

Customer support from Check Point and Radware is excellent.

We used Cloud Provider Services for DDoS mitigation provided by our ISP. We still use that service for protection against volumetric attacks (Clean Pipe).

The setup was straightforward and the support was excellent.

The configuration requires understanding the services that are hosted against each public IP, as there might be some additional configuration required depending upon the application or services.

This solution was deployed by our in-house team along with the OEM.

The appliance comes with a loaded hardware license, and additional options such as SSL can be purchased and enabled.

We evaluated a couple of solutions including Arbor DDoS and a product by F5. We found that Check Point was able to provide us superior capabilities and features on the basis we were evaluating.

My advice for anybody who is considering this product is to evaluate based on the following points:

• Where you want to place or installed your DDOS appliance.
• What throughput mitigation is required.
• Whether the device supports cloud signaling.
• Determine whether the SSL decryption card is available with the box or needs to be purchased in addition.
• License and port requirements in terms of whether you need copper or fiber. 

Our company works in the area of developing and delivering online gambling platforms. The Check Point Next-Generation Firewalls are the core security solution we use for the protection of our DataCenter environment, located in Asia (Taiwan).

The environment has about 50 physical servers as virtualization hosts, and we have two HA Clusters consisting of 2x5400 hardware appliances, managed by an OpenServer Security Management Server on a Virtual Machine (KVM), all running on R80.10 with the latest JumboHotfix.

The Check Point DDoS Protector 20 is directly connected to one of the ISPs we are connected to, using LACP and static routing.

Our DataCenter environment in Taiwan serves the incoming user traffic, thus it is connected to the Internet and needs protection from DDoS attacks. Not all of the Internet Service Providers are able to provide DDoS mitigation.

For example, among the three providers we use in Taiwan, only one provides such a service. To protect the other lines, we had to implement the Check Point DDoS Protector as a hardware solution. Now, all the ISP lines are protected and we can switch the users back and forth between them with the same level of security.

The traffic processing latency is at a good level, being about 40 microseconds on the average for our traffic pattern. I believe most of the users will not even notice that this solution is on the traffic path.

The appliances have the hardware-based SSL engine, which allows it to offload and inspect the SSL/TLS encrypted traffic of the various standards.

The is a really low level of the false-positive alerts (when the clean traffic is marked as DDoS) due to some advanced techniques used by Check Point under the hood.

For a long time, there was no software version of R80.10 available for the Check Point DDoS Protector software appliances, and we had to stay on the quite outdated R77.30 version. I hope in the future, Check Point would release the relevant software version sooner.

In addition, it feels like there is no matching hardware platform in case we will need to switch from the "20" appliance. The next one available is "60", which is too powerful and much more expensive. We would prefer the systems to be modular, so the performance may be upgraded with some relatively cheap modules when there is a need.

We have been using the Check Point DDoS Protector for about two years.

The solution is stable, and no software or performance issues have been noticed.

The solution is not really scalable, in my opinion. You should buy the correct hardware appliance with a gap for future growth.

No support tickets have been opened so far.

This is the first hardware DDoS mitigation solution we use.

The setup was quite straightforward with no drawbacks from a technical standpoint. However, you should have at least have a basic understanding of DDoS types and behaviour for the initial setup.

The deployment was done by our in-house team. We have a Check Point Certified engineer working in the engineering team.

Also, we got some help from the ISP's engineers that we were connecting to.

Since we have a strong Check Point knowledge expertise among the engineering team, we did not evaluate other options.

Check Point DDoS Protector was first used as an add-on infrastructure solution for DDoS mitigation. We as a company have Azure and we wanted to complete it with another security tool capable of protecting against DDoS attacks for volumetric, low, and slow attacks in layer three to layer seven. For this reason, we decided to implement Check Point to do double security both in the Azure cloud and in the perimeter network to have better DNS packet rates and provide the best quality of experience, even under attack.

Check Point DDoS Protector has given us great security in zero-day DDOS protection. Intelligent attack mitigation also gives us the most accurate attack detection and prevention without blocking legitimate user traffic. It also provides full investment and lifetime protection in an extended platform. It is another of the key features why we adopted this technology. It offered complete protection of data center applications against emerging network threats and maintains excellent user response time even under attack.

Check Point DDoS Protector is a product that uses machine learning and behavior analysis. It also includes a comprehensive suite of four essential security modules: Anti-DDoS, Network Behavior Analysis (NBA), Intrusion Prevention System (IPS), and Protection against SSL attacks. The improved traffic processing latency is at a good level.

Check Point DDoS Protector generates a really low level of false-positive alerts. This is a good thing as they don't fill the mailboxes with false alerts and you don't have to be as vigilant.

Check Point DDoS Protector does not provide the ability to upload data for the blacklist/whitelist in bulk, which is one of the big points that need to be improved to facilitate configurations. 

Another point of improvement is that they should provide more details of the traffic in real-time. To be able to have more detail would be ideal. 

Also, it takes a long time to generate an update of the software version of R80.10. They should be generating updates a little more often to improve the tool since day by day everything is changing in security.

It has been implemented for a year and a half.

It is a fairly stable product, maintains security, and is reliable.

Check Point DDoS Protector is scalable and provides an auto pass-through option for fiber. it is an excellent tool.

So, far the support has been quite efficient.

Positive

The solution is managed in the cloud and we needed to add an extra perimeter solution to the network.

The configuration and implementation were simple. It is very friendly and easy to use.

The implementation and configuration were done jointly with a vendor and the IT department.

Check Point DDoS Protector has generated excellent security which has protected our assets.

Check Point DDoS Protector comes with a hardware license where it also comes with other options that can be enabled and is an accessible tool.

Other options were not evaluated since we handle several Check Point products already and we wanted to follow the line.

It is an excellent tool for perimeter security.

We use this technology in our company as a DDoS mitigation solution.

We are required to be able to face modern denial of service attacks for our applications which are really vital for our clients.

It is really important to be able to monitor, prevent, and mitigate attacks of this type. With Check Point and its model of known and unknown threats, its way of dealing with these problems helped us avoid crashes in our front-end infrastructure as well as internal ones. It's generating stability and trust for our clients and users.

Check Point DDoS Protector was able to help with the mitigation and in addition to that protect us from vulnerabilities at the SSL level. In a very easy way, modern attacks can be prevented to encourage the correct functioning of services. By avoiding these attacks we managed to provide very important stability and business continuity for us.

The protection of Check Point DDoS protector is a very effective and fast solution. It was important to request support from our vendor to be able to put it into proper operation, under the best current Check Point practices. The result was a good implementation and satisfaction for the company.

Check Point DDoS Protector uses many features that are very important to us such as machine learning and behavior analysis. Under traffic policies, anything correctly detected as normal traffic is fine but traffic that tends to be malicious and does not adjust with the policies it is immediately blocked.

Its protection generates the automatic creation of signatures to avoid zero-day service denial attacks. Its protection against DNS attacks is very effective.

This technology really meets our expectations.

Something that should be improved across the board is the way they provide support. It can be more effective and improve over time.

On the other hand, the generation of either white or black lists cannot be carried out en masse, which generates a lot of administration and management for the security team.

Its administration can be more intuitive. It could be used at the level of SmartConsole or as it is the infinity portal, there are some improvements that can be generated for customer satisfaction.

During times of the pandemic, we verified that many of our web applications exposed to the internet were vulnerable targets for denial-of-service attacks. We used a Check Point device to mitigate them during the last six months approximately, and have been really happy with the product.

The implementation was carried out with the parameters of best practices sent by the manufacturer with the help of the partner. I do not see that we can improve this. We must continue testing to see in time what must be adjusted. For the moment, everything works right.

Regarding the cost, it doesn't seem like a very expensive option to me. However, new users should also take into account best practices and request support from a good Check Point partner to help implement everything correctly.

We haven't really used physical tools. We used Azure WAF for a while to avoid problems, however, this technology is more effective.

Our company handles a lot of information and it is vital to have it protected. Currently, DDoS attacks are becoming more modern. They generate new ways to exploit sectors with vulnerabilities which can be exploited to have access to, and seize data among others.

An attack of this type can generate a loss of work continuity generating both information and economic losses, for which we required a proactive tool that will help us correct these possible security flaws, so we opted for the use of Check Point DDoS Protector.

In our company, we have several applications published in Microsoft Azure in-app services. We required a tool that would help us shield business applications a little more from modern threats - including intelligent SSL attacks, and protection against zero-day attacks - preventing us from having a failure in services that would translate into economic losses for the company.

This is why Check Point perfectly matched the problem we had and helped us solve the security flaws.

It helped us a lot to mitigate and management and the company's top managers feel quite safe with Check Point.

First of all, the tool is easy to implement. It is one of the features of Check Point and is up and running with some basic configurations.

It has a quite intuitive portal for the user. In this way, it is possible to generate greater and easier control of the checkpoint security applications.

Zero-day protection is very useful. It really helps to avoid modern threats that can affect or impact the productivity of a business. It uses several layers of security. It's innovative and that helps a lot.

Threat mitigation is very good for both cloud and on-premise environments.

The areas where the Check Point manufacturer in general needs to improve, including:

1-The support can provide improvements in the efficiency of the solution of cases, improvements in response times, and more hours of attention to be able to provide users with a more robust security service.

2- The public documentation is a detail that must be improved in order to have greater implementations with the best practices in this case of the Check Point manufacturer. Some found publicly are a bit advanced or the same result is not achieved in the implementation icon.

I've used the solution for just over 12 months. This tool works quite well for DDoS protection in our company.

We had not used a tool for this type of protection before.

It is important to have the help of a specialized partner who provides guides in addition to validating the client's requirements in order to match them in the best way with the available Check Point tools.

Check Point was the first option. It perfectly matched what was requested by management. Its efficiency is very good, and, with the help of the partner, we were able to provide a correct implementation.